Privacy Policy

Account information — When you sign up, we collect your name, email address, and profile photo through our authentication provider (Clerk). If you sign in with Google, Apple, or Facebook OAuth, we receive only your basic profile information from those providers.

Social media tokens — When you connect a social account (LinkedIn, X, Facebook, Instagram, YouTube, TikTok, Pinterest, Reddit, Threads, Google Business, Telegram, Quora), we store an encrypted access token granted by that platform's OAuth flow. We never see or store your social media passwords. Tokens are encrypted at rest using AES-256-GCM.

Content you create — Posts, captions, schedules, media files, brand voice profiles, content pillars, knowledge base items, and any other content you produce or upload to the Service.

Engagement metrics — Likes, comments, shares, impressions, follower counts, and other public analytics on your own posts, retrieved from social platforms via their official APIs.

Inbox messages — When you use Smart Inbox, comments and direct messages on your own posts are fetched from social platforms so you can reply from a unified view.

Usage data — Anonymous analytics about how you use the app (page views, feature usage) to improve the Service.

Payment information — Billing handled by Stripe. We do not store credit card numbers; Stripe provides us only with a customer ID and subscription status.

• Authenticate you and keep your account secure
• Publish posts, schedule content, and manage social interactions on your behalf (only on accounts you explicitly connect)
• Generate AI content using your brand voice and pillars
• Show you analytics and insights about your social presence
• Aggregate engagement metrics for the Smart Inbox
• Detect mentions and alerts via Social Listening
• Send transactional emails (password reset, approval requests)
• Process billing for paid plans
• Improve the Service and develop new features

We share data with the following sub-processors strictly to provide the Service:

• Clerk — authentication, user identity (clerk.com/privacy)
• Anthropic (Claude API) — AI content generation; we send only the text needed to generate the response. We do not opt your content into model training.
• OpenAI — alternative AI provider when selected.
• Vercel — application hosting and serverless compute.
• Railway / Postgres — database hosting.
• Stripe — payment processing.
• Social platforms — Meta (Facebook, Instagram, Threads), LinkedIn, X/Twitter, YouTube, TikTok, Pinterest, Reddit, Telegram, Google Business — only for the OAuth permissions you grant.

When you publish through Social Edam, the content you post becomes governed by that platform's own terms and privacy policy. We act only as the bridge that delivers the content via their official APIs.

We never use your social media tokens for anything other than the specific actions you initiate (publishing, fetching analytics, fetching messages you have access to). We do not scrape, sell, or redistribute data we obtain from social platforms.

We retain your data for as long as your account is active. If you cancel your subscription but keep your account, your data stays. If you delete your account, all your data is permanently deleted within 30 days, except where retention is legally required (e.g., tax records for billing). You can also disconnect a social account at any time, which immediately deletes the encrypted token for that platform.

Under GDPR, CCPA, and similar laws, you have the right to:

• Access the data we hold about you
• Correct inaccurate information
• Delete your account and all associated data
• Export your data in a portable format
• Restrict or object to certain processing
• Withdraw consent at any time

To exercise any of these rights, contact us at privacy@socialedam.com or visit our Data Deletion page.

We protect your data with industry-standard measures: TLS 1.3 in transit, AES-256-GCM for sensitive fields at rest (social media tokens, API keys), Clerk-managed session tokens with rotation, and Vercel's isolated serverless runtime. Access to production data is restricted to authorized personnel and audited.

No system is perfectly secure. If we discover a breach affecting your data, we will notify you within 72 hours.

We use only essential cookies needed to keep you signed in (Clerk session cookie) and to remember your theme preferences (stored in localStorage). We do not use third-party advertising or tracking cookies.

The Service is not intended for users under 16. We do not knowingly collect personal data from children. If you believe a child has provided data to us, contact us and we will delete it.

Our servers are located in the United States and the European Union. By using the Service, you consent to your data being transferred to and processed in these regions. We use standard contractual clauses where required for cross-border transfers.

We may update this Privacy Policy from time to time. Material changes will be announced by email and a banner in the app at least 14 days before they take effect.

For privacy questions, data requests, or complaints:

• Email: privacy@socialedam.com
• Data deletion: socialedam.com/data-deletion
• Company: Revenco Agency